Impact In a Cilium cluster with mutual authentication enabled, an attacker with any valid client certificate can completely bypass mutual authentication and impersonate any other identity in the cluster. This occurs if they obtain the public certificate of the target identity and append it to their certificate chain during the TLS handshake. Cilium mutual authentication is a beta feature that has been "marked for deprecation" (https://github.com/cilium/cilium/issues/47132). ### Patches This issue is patched by https://github.com/cilium/cilium/commit/168d16627bfb7b96717cf8dff54e33ceac09192c, which is included in: - Cilium v1.19.6 - Cilium v1.18.12 - Cilium v1.17.18 This issue affects: - Cilium v1.19 between v1.19.0 and v1.19.5 inclusive - Cilium v1.18 between v1.18.0 and v1.18.11 inclusive - Cilium v1.17 between v1.17.0 and v1.17.17 inclusive - Cilium between v1.14.0 and v1.16.19 inclusive ### Workarounds There is no known workaround for this issue. ### Acknowledgements The Cilium community has worked together with members of Google and Isovalent to prepare these mitigations. Special thanks to @mikiiier for reporting this issue and preparing the fix, and to @youngnick for their assistance in reviewing the solution. ### For more information If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at "security@cilium.io" (mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.